HackingTechnologyInformationStolen CredentialsCapture Stored DataTargetedCustomer Data InvolvedPIICredentialsIdentity (basic)HighContained

Mate1.com

bd_31b7e6e72404a836 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 14, 2016

Filed

Jun 8, 2016

To disclose

8 weeks

Affected

406,080state residents only

Confidence

66%

Full breach record for Mate1.com →

Mate1.com notified Washington AG of a security incident where an unauthorized individual accessed user profile data (name, username, password) in October 2015. Incident discovered April 14, 2016. 406,080 WA residents affected. Notifications sent June 2-6, 2016. Remediation included encryption and security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 196 days

discovery → filing · 8 weeks / 55 days

Oct 1, 2015

Begins

Apr 14, 2016

Discovered

Jun 8, 2016

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed406,080 affectedView incident

Name: THOMPSON COBURN LLP
norm: thompson coburn
Domain: thompsoncoburn.com

Name: Mate1.com
norm: mate1com
Industry: Technologyllm

Discovered: Apr 14, 2016
Breach occurred: Oct 1, 2015
Undetected for: 196 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2016
Affected individuals: 406,080state-resident count only
Data types: PIICredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Washington Attorney General's Office as a courtesy
Initial access: exploit_public_facing

During the incident: Engaged third party computer forensic experts
Implemented further network security measures
Encrypted usernames and passwords
Advised impacted individuals to change passwords
Changes made: Implemented further network security measures
Reviewed policies and procedures to ensure information in its control is properly protected
All passwords in system are now encrypted
Fixed the vulnerability that caused the security incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9624.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2016
Raw hash: 6f0b361657fdf76bf59e06190c86b2bd6f5cfa94f21783034217a7a491975665

Reporting entityTHOMPSON COBURN LLP

Victim entityMate1.com

Incidentdiscovered Apr 14, 2016

Stated responseEngaged third party computer forensic experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com